# Picture Gallery – Frontend Image Uploads, AJAX Photo List <= 1.6.2 - Authenticated (Contributor+) Path Traversal to Arbitrary File Read via 'importFiles' Parameter

- **ID:** WPSEC-2026-1403
- **Plugin:** Picture Gallery – Frontend Image Uploads, AJAX Photo List (`picture-gallery`), https://wordpress.org/plugins/picture-gallery/
- **Affected versions:** all versions before 1.7.21
- **Fixed in:** 1.7.21 (Update to 1.7.21 or later.)
- **Severity:** Medium 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
- **Weakness:** CWE-22
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-21)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/picture-gallery
- **Fix released:** 2026-10-20
- **Published:** 2026-10-21
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1403/

## Description

The Picture Gallery plugin for WordPress is vulnerable to Path Traversal via the 'importFiles' parameter of the picture import form (videowhisper_picture_import shortcode) in all versions up to, and including, 1.6.2. This is due to submitted file names not being sanitized before they are joined to the import folder path, and the import folder (the shortcode's 'path' attribute) not being limited to the configured import directory. This makes it possible for authenticated attackers, with Contributor-level access and above (the plugin's default sharing roles), to copy arbitrary files from the server into the plugin's public uploads directory as published pictures and then read their contents, which may expose sensitive information.

## References

- https://wpsec.com/vuln/WPSEC-2026-1403/
- https://plugins.svn.wordpress.org/picture-gallery/tags/1.7.21/
- https://wordpress.org/plugins/picture-gallery/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1403/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.